If your using basic authentication, you can use the [url]http://[/url]username:password@URL syntax, but if your going to do that you need to use a server side script (use a GET request if you need to put it on a link) to ensure that the client never see's the un-encoded auth details.
Also, use the application/pdf mime type so that the browser will render the page using Adobe, if it is present, instead of offering the standard Open/Save/Cancel download box.